The Rabbit R1 has been logging users' chats – with no way to wipe them | Hacker News Reader

The Rabbit R1 has been logging users' chats – with no way to wipe them

theverge.com

22 pointscroes11 comments

The linked story where the company claims an employee leaked keys to a “hacktivist” group and then something about sending defamatory emails to employees is very strange: https://www.rabbit.tech/security-investigation-062524

Nothing about this feels like a well-run engineering team. I understand it’s a startup, but all of this is just weird.

See this video by Coffeezilla: https://www.youtube.com/watch?v=NPOHf20slZg It's a bit clickbaity, but turns out Rabbit was a crypto-nft-ai buzzword company with a very shady history.

In this light I can't help but imagine Jian Yang from Silicon Valley running one of his schemes. It's funny to think about, but also hits close to home.

I just had a (contract) team member "quit" abruptly. Happy happy, oh I'm burned out, and need to take 3 months off, maybe more. I'm the last person in the world that would overwork an employee. In fact, I spend a good amount of my time pushing back against anything that would cause overwork. Burnout can happen for multiple reasons, and with various manifestations, so I may never know whether the person was actually burned out.

I've definitely been across situations where life intrudes into the work as well. Partners trying to get into a building (previous job) to confront an employee about cheating.

Humans are messy. Yes it might be the startup itself that has brought these problems on itself, but that isn't a certainty.

The story was about an employee supposedly sabotaging the company from the inside and leaking secret keys, not someone who quit from burnout.

> I understand it’s a startup, but all of this is just weird.

You should watch Coffeezilla's video too. Rabbit is a big can of maggots and the tech is only the cherry on the shit stew

Feels like a case study in _why not_ to trust internet randos without hardware experience with a device that's meant to handle a bunch of private data.

The article says that an incoming update is addressing this by giving people the option to delete local data, so it looks like this soon won’t be an issue.

But stepping back, it is not at all surprising to hear about this type of flaw. MOST startups have these kinds of flaws. They spend as little as possible on things like security or privacy. Enough to meet some checklist minimally but not enough to actually respect customers and their data. In some ways it is understandable since they have to do whatever they can to survive, and the chances of that are low to begin with - so saving their energy and time for other things is what happens.

I bet most customers would be frightened if they knew exactly how cavalier most startups truly are.

> I bet most customers would be frightened if they knew exactly how cavalier most startups truly are.

I think it's more about being able to push liability for a service onto a vendor (the startup) and less about making sure the vendor is actually capable of accepting the liability. Except where laws state otherwise.

And this is why user data should be stored encrypted. Not just at rest but zero access encryption or - where possible - client side, end-to-end encryption.

I'll make a short shameless plug: If you would like to use generative AI (OpenAI/Google/Anthropic/Open source) but don't want to run everything yourself, Cognos[0] stores your conversations encrypted so there are no risks of hacks, leaks or your data being used for training.

[0] https://app.cognos.io/

I remember watching Coffezilla's vid on Rabbit R1, and it looks both shady, and 10 years away from what it is promised to be.

Reply on news.ycombinator.com